Specifications of default roles

There are four types of roles provided by default in Splunk:

• admin:
  This is an administrator role. Permissions required to manage things like importing data and changing settings are assigned.
• power:
  A role that allows sharing searches, alerts, tags, and event types with other users.
• user:
  This is a role for general users. Basically, it is assumed that searches are performed in the environment prepared by the administrator, and setting changes are not permitted.
• can_delete:
  A role that is permitted to execute the delete command for imported data.

In addition, "splunk-system-role" is a role used inside the system, and it is not recommended to assign it to users.

The privileges are the same as the admin role, but the settings for "Search Limits" are different, such as the search time range and number of simultaneous search jobs, etc., compared to the admin role.

For specific differences, please check the Splunk Web settings below.

• Settings > Roles > admin "Search Restrictions"
• Settings > Role > splunk-system-role "Search Restrictions"

Procedure for creating a new role

If you want to assign fine-grained permissions to users, you need to create a new role and select the permissions you want to assign.

After deciding the authority you want to assign, create a new role by following the setting procedure below.

[New role setting procedure]

After creating the role, assign the role to the user by following the setting procedure below.

[New user creation procedure]

With the above settings, it is possible to create a role and create a user to assign it.